Microsoft Exchange - Reflected Cross-Site Scripting (CVE-2021-41349)

Microsoft Exchange is affected by a Cross-Site Scripting (XSS) vulnerability, located in the Autodiscover endpoint. The root cause of this vulnerability consists in the lack of input validation in the URL query string. An attacker can exploit this vulnerability to inject malicious JavaScript code in the URI.

The risk exists that a remote unauthenticated attacker could exploit this vulnerability and send malicious URLs to the Exchange clients which can then steal their unencrypted usernames and passwords if accessed.

Upgrade the Exchange server to the latest version.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41349

https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41349